350-401 practice questions 441–450

1. Question 441 · 1003 in bank

   Select 2

   Which two parameters are examples of a QoS traffic descriptor? (Choose two.)

   • ADSCP
   • BMPLS EXP bits
   • Cpacket size
   • Dbandwidth
   • EToS

   Show answer

   Answer: AB

   Explanation

   From the OCG page 368: "The following traffic descriptors are typically used for classification: ■ Internal: QoS groups (locally significant to a router) ■ Layer 1: Physical interface, subinterface, or port ■ Layer 2: MAC address and 802.1Q/p Class of Service (CoS) bits ■ Layer 2.5: MPLS Experimental (EXP) bits ■ Layer 3: Differentiated Services Code Points (DSCP), IP Precedence (IPP), and source/ destination IP address ■ Layer 4: TCP or UDP ports ■ Layer 7: Next Generation Network-Based Application Recognition (NBAR2)". A and B are correct.

   Source: Adapted from community discussion — iGlitch

   References

   • Cisco documentation

   Next question

2. Question 442 · 1003 in bank

   

   Refer to the exhibit. An engineer attempts to create a configuration to allow the Blue VRF to leak into the global routing table, but the configuration does not function as expected. Which action resolves this issue?

   • AChange the source network that is specified in access-list 101.
   • BChange the access-list destination mask to a wildcard.
   • CChange the access-list number in the route map.
   • DChange the route-map configuration to VRF_BLUE.

   Show answer

   Answer: B

   References

   • Cisco documentation

   Next question

3. Question 443 · 1003 in bank

   An engineer must configure a multicast UDP jitter operation. Which configuration should be applied?

   • ARouter(config)#ip sla 1 Router(config)#udp-jitter 192.0.2.115 65051
   • BRouter(config)#ip sla 1 Router(config)#udp jitter 239.1.1.1 65051 end-point list List source-ip 192.168.1.1
   • CRouter(config)#ip sla 1 Router(config)#udp-jitter 192.0.2.115 65051 num-packets 20
   • DRouter(config)#ip sla 1 Router(config)#udp jitter 10.0.0.1 source-ip 192.168.1.1

   Show answer

   Answer: B

   Explanation

   Configures the IPSLAs operation as a multicast UDPjitter operation and enters multicast UDP jitter configuration mode. udp-jitter {destination-ip-address| destination-hostname} destination-port endpoint-list endpoint-list [ssm] [source-ip ip-address] [source-port port-number] [num-packets number-of-packets] [interval interpacket-interval] Example: Device(config-ip-sla)# udp-jitter 239.1.1.1 5000 endpoint-list mcast-rcvrs source-ip 10.10.10.106 source-port 7012 num-packets 50 interval 25 The given answer B is misssing - , upd jitter >> udp-jitter

   Source: Adapted from community discussion — TSKARAN

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • cisco.com documentation

   Next question

4. Question 444 · 1003 in bank

   

   Refer to the exhibit. The network administrator must be able to perform configuration changes when all the RADIUS servers are unreachable. Which configuration allows all commands to be authorized if the user has successfully authenticated?

   • Aaaa authentication login default group radius local none
   • Baaa authorization exec default group radius
   • Caaa authorization exec default group radius if-authenticated
   • Daaa authorization exec default group radius none

   Show answer

   Answer: C

   Explanation

   Although C & D can both let network administrator to perform changes when RADIUS servers are unreachable, C is doing what the question asking for - "to be authorized if the user has successfully authenticated" "if-authenticated" allows user get authorized (every command the user enter is authorized) in the session if user is authenticated by any of methods defined in aaa meanwhile "none" disable authorization (every command the user enter does not need authorization) for the session if the defined authorization method in aaa is unreachable ENCOR OCG Page 775 has specified that

   Source: Adapted from community discussion — kmb192006

   Next question

5. Question 445 · 1003 in bank

   Select 2

   In a Cisco SD-WAN solution, which two functions are performed by OMP? (Choose two.)

   • Aadvertisement of network prefixes and their attributes
   • Bconfiguration of control and data policies
   • Cgathering of underlay infrastructure data
   • Ddelivery of crypto keys
   • Esegmentation and differentiation of traffic

   Show answer

   Answer: AD

   Explanation

   A and D is correct. The OMP protocol is responsible for: – Distribution of Transport Locators (TLOCs) among network sites in the sd-wan domain. – Distribution of service-side reachability information. – Distribution of service-chaining information. – Distribution of data plane security parameters, VPN labels, and crypto keys. – Distribution of data and application-aware routing (AAR) policies. (Answer E is not correct as OMP is only distribute, not configure data policies) Reference: https://www.networkacademy.io/ccie-enterprise/sdwan/omp-overview

   Source: Adapted from community discussion — jj970us

   Next question

6. Question 446 · 1003 in bank

   How can an engineer prevent basic replay attacks from people who try to brute force a system via REST API?

   • AAdd a timestamp to the request in the API header.
   • BUse a password hash.
   • CAdd OAuth to the request in the API header.
   • DUse HTTPS.

   Show answer

   Answer: A

   Explanation

   A is the Answer. Here's the list of best practices in securing RESTful API. 1. Always Use HTTPS - Traffic must be encrypted 2. Never expose information on URLs - as this can be captured in web server logs, which makes them easily exploitable. 3. Consider Oauth 4. Adding Timestamp in Request - This will prevent very basic replay attacks from people who are trying to brute force your system 5. Input Parameter Validation - Put strong validation checks and reject the request immediately if validation fails. 6. Use Auditing and Logging - Any subject or entity can be audited

   Source: Adapted from community discussion — kebkim

   Next question

7. Question 447 · 1003 in bank

   What are the main components of Cisco TrustSec?

   • ACisco ISE and Enterprise Directory Services
   • BCisco ISE, network switches, firewalls, and routers
   • CCisco ISE and TACACS+
   • DCisco ASA and Cisco Firepower Threat Defense

   Show answer

   Answer: B

   Explanation

   B - Cisco TrustSec and Secure Access Solution Components • FlexAuth (802.1X, WebAuth, MAB): All Cisco Catalyst® switching platforms • Device sensors: Cisco Catalyst 3000 Series; Cisco Catalyst 4500 Series with Supervisor 7(L)-E; Cisco Wireless LAN Controllers • Cisco TrustSec: - Cisco Catalyst 2960-S/SF/C, 3560, 3560-E/C, 3750, 3750-E Series: SXP only - Cisco Catalyst 3560-X, 3750-X Series: SXP, SGT, SGACL - Cisco Catalyst 4500 Series with Supervisor 6(L)-E, 7(L)-E: SXP only - Cisco Catalyst 6500 with Supervisor Engine 2T: SXP, SGT, SGACL - Cisco Nexus 7000 and 5000 Series: SXP, SGT, SGACL - Cisco Nexus 1000v: SXP only - Cisco Wireless LAN Controller 2500, 5500, Cisco Wireless Service Module (WiSM) 2, Cisco Wireless Controller on Cisco Services-Ready Engine (SRE): SXP only - Cisco Integrated Services Router G2: SXP, Security Group Firewall (SG-FW) - Cisco ASR 1000 Series Aggregation Services Router: SXP, SG-FW - Cisco ASA 5500 Series Adaptive Security Appliances: SXP, SG-FW - Virtual Desktop Infrastructure (VDI) and Cisco AnyConnect® Secure Mobility Client with Remote Desktop Protocol (RDP)

   Source: Adapted from community discussion — AndreasThornus

   References

   • Cisco documentation

   Next question

8. Question 448 · 1003 in bank

   What is a characteristic of a WLC that is in master controller mode?

   • AConfiguration on the master controller is executed on all wireless LAN controllers.
   • BThe master controller is responsible for load balancing all connecting clients to other controllers.
   • CAll new APs that join the WLAN are assigned to the master controller.
   • DAll wireless LAN controllers are managed by the master controller.

   Show answer

   Answer: C

   Explanation

   When there is a master controller enabled, all newly added access points with no primary, secondary, or tertiary controllers assigned associate with the master controller on the same subnet.

   Source: Adapted from community discussion — kebkim

   Next question

9. Question 449 · 1003 in bank

   What is the function of a fabric border node in a Cisco SD-Access environment?

   • ATo collect traffic flow information toward external networks.
   • BTo connect the Cisco SD-Access fabric to another fabric or external Layer 3 networks.
   • CTo attach and register clients to the fabric.
   • DTo handle an ordered list of IP addresses and locations for endpoints in the fabric.

   Show answer

   Answer: B

   Explanation

   B is the correct answer. Border bode: The border nodes serve as the gateways between the Cisco SD-Access fabric and external networks.

   Source: Adapted from community discussion — rpidcock

   References

   • Cisco documentation

   Next question

10. Question 450 · 1003 in bank

    Which Cisco FlexConnect state allows wireless users that are connected to the network to continue working after the connection to the WLC has been lost?

    • AAuthentication Down/Switching Down
    • BAuthentication-Central/Switch-Local
    • CAuthentication-Central/Switch-Central
    • DAuthentication-Down/Switch-Local

    Show answer

    Answer: D

    Explanation

    It is D Taken from this Cisco document: https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-5/config-guide/b_cg85/flexconnect.html "authentication down, local switching—In this state, the WLAN rejects any new clients trying to authenticate, but it continues sending beacon and probe responses to keep existing clients alive. This state is valid only in standalone mode."

    Source: Adapted from community discussion — StefanOT2

    References

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-401 practice, question 441. 1003 questions available.